Hackers Use WebAPK to Install Malware as Native Application on Android Device

The latest research reveals a new sophisticated attack carried through Webapk technology targeting Android devices.

The threat actors manipulate the user to install malicious web apk through a Smishing attempt by impersonating legit banking sources.

The CSIRT KNF team carried out a detailed analysis of a website reported by RIFFSEC and published its result in their latest article.

Malware as Native Application

Initially, the threat actors send sms to the targeted victims suggesting they update the banking application by clicking the link.

The link embedded in the message redirects the user to the site using Web APK technology to download malicious applications.

Webapk refers to a technology that allows for the creation of web applications that can be installed and run like native Android apps.

WebAPK allows the installation of web applications directly from the browser without the need to use the Google Play Store.

Once the application is installed, it appears like a banking application and asks user credentials for authorization.

This attack poses a serious threat due to the ability to install a malicious application without displaying typical warnings associated with installations from untrusted sources.

The application is signed with the Google Chrome certificate, which is why it appears in the system settings as installed by Google Play Protect.

WebAPK applications create unique package names and checksums on each device, making such attacks difficult to defend against. 

Indicators of Compromise (IoC) are difficult to utilize since the Chrome engine dynamically builds them.

Recommendations:

Detection of such applications by antivirus systems is complex and often impossible.

 For this reason, one of the most effective ways to prevent the attack  

is by detecting and blocking websites that use the WebAPK mechanism to carry out phishing attacks.

Recommend an approach focused on identifying and blocking these sites to minimize the risk to users.

Sourc: https://cybersecuritynews.com/hackers-use-webapk-malware/